PT-2005-3367 · Kayako · Kayako Liveresponse

James Bercegay · Publicado 2005-12-31 · Atualizado 2016-10-18 · CVE-2005-2462

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kayako liveResponse versions 2.x

Description The issue allows local users and possibly remote attackers to gain privileges by exploiting the fact that passwords are recorded in plaintext in the URL when a user logs in.

Recommendations For Kayako liveResponse versions 2.x, consider disabling the login functionality until a fix is available to prevent passwords from being recorded in plaintext. Restrict access to the login module to minimize the risk of exploitation. Avoid using the password parameter in the affected login endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-2462

Produtos afetados

Kayako Liveresponse

Referências · 6

• http://osvdb.org/18398 · Nota
• http://marc.info/?l=bugtraq&m=112274359718863&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2462 · Nota de Segurança
• http://gulftech.org/?node=research&article_id=00092-07302005 · Nota
• http://securityfocus.com/bid/14425 · Nota
• http://secunia.com/advisories/16286 · Aviso do Fabricante